Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)

After logging out of the application, the session associated with the user is not invalidated server-side. An attacker with access to the session cookie prior to logout can reuse the same cookie to re-authenticate, effectively bypassing the logout process and regaining access to the account.